Creativity of cybercriminals increases the demand for information security in the financial sector

During the Covid-19 pandemic, the home office became popular and dependency on digital services and apps increased in the professional environment. Consequently, the attention of cybercriminals increased, who began to attack the assets necessary to maintain this infrastructure en masse. All sectors, in general, were more exposed, each with its individual risk that needs to be assessed from the impact to the protection of each environment. However, one of them is - and always has been - under constant attack since the early days of its digitization: the financial sector.

The motive, as is commonly the case for these crimes, is clear: money. The big difference is that it is in these institutions that he is literally located. In this way, with each new product or functionality that appears in the segment, there is a legion of fraudsters who move around looking for an unprecedented way to subvert systems, exploit vulnerabilities and obtain gains through an illegal transaction. Therefore, the segment's investment to contain the advance of cybercriminal threats has been increasing year after year. The Febraban Banking Technology Survey 2021 shows that banks invested BRL 2.5 billion in information security in 2020. 

The amount represents 10% of spending on technology in the year in question, out of a total investment of BRL 25.7 billion - amount 8% higher than the previous year. The types of attacks performed in these cases range from the extremely simple to the most sophisticated. Criminals tend to always be one step ahead, circumventing the implemented protection measures. 

Threats happen in all forms, such as, for example, ransomware (similar to a digital data hijacking, where attackers demand a ransom value), massive data leaks and compromises of internal servers, often for a long period of time. time without detection - allowing cybercriminals to gain access to a wealth of valuable information. However, one of the biggest concerns is with applications, be they mobile, web or desktop. Penetration tests - also called Pentests by professionals in the field - reveal security flaws in the architecture or structure of an application that would allow an attacker to do something in a different way than what was planned for it and thus carry out a fraud. It should be noted that, in general terms, criminals are, most of the time, at an advantage, in the sense that defending is much more challenging than attacking. 

The attack surface for circumventing systems is gigantic, as all it takes is one failure for the attacker, in theory, to be successful. Surveillance must be constant. There is never a plateau when it comes to cybersecurity. It is always necessary to be aware of new and constant threats and update defenses, from the beginning of the systems development process to the production phase, because new features also introduce new vulnerabilities. Therefore, information security must be a continuous cycle of testing, detecting failures and applying corrections.

Anticipation of cybercrime

The keyword for financial institutions when it comes to fighting cyberattacks is updating. The role of cybercriminals is extremely volatile, making it a duty of the sector to constantly modernize its defense tactics. One of the recommended ways to do this is offensive security focused on Pentest, the so-called intrusion tests. The technique involves the simulation of a cyber attack, carried out by professional hackers, which generates a complete report of the flaws found and how to correct them. 

That is, it is a way of anticipating criminal action, predicting the flaws that may give the attacker the opportunity to find. With this solution, it is also possible to create more strategic planning on how the institution can react in times of attack and, thus, reduce damage. It is only with this level of attention to the subject that the segment can face the problem. 

Given the current scenario, in which changes in the digital environment occur every day, waiting for criminal action to act later can be fatal. The constant zeal of the financial sector, which is the one that is most likely to be harmed by cyberattacks, leads us to a digitally more peaceful and promising future.

*Willian Caprino is a cybersecurity specialist and Director of New Business Development at Blaze Information Security with over 25 years of experience. He has worked for large national and international companies such as Cielo, Banco CCF Brasil and Telefônica. He has an MBA from Fundação Getúlio Vargas and Information Systems Security certification from (ISC)².